From 38cd0b040bc1ba9898b36a831b5c9aab94995d69 Mon Sep 17 00:00:00 2001
From: Paul O'Reilly <hello@pauloreilly.nz>
Date: Fri, 4 Sep 2026 05:31:34 +1200
Subject: [PATCH] =?UTF-8?q?feat(harness):=20cp-service-token/v1=20context?=
 =?UTF-8?q?=20=E2=80=94=20AU-51/AU-51b=20credential=20for=20decompose?=
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

New context mounts the cp-decompose-service-token account (system
provider type, account_id 1d963673-6ac9-4f85-875a-2ce5323e76ad, owner
(cp, cp)) via ESO and exports CP_SERVICE_TOKEN_FILE pointing at the
mounted secret file. Wired into spec-writing-sonnet-repo (backs
scope-decompose-sonnet@1, which calls back POST
/v1/work-items/{id}/decompose — bug b3a96acc / fa41caac / M42 stall).

The mounted value must match the CP's CP_INTERNAL_BEARER_TOKEN
(agent-runtimes deploy repo, overlays/{production,staging}/app-secret.sops.yaml).

No init.sh needed — the mount path is static at harness-authoring time
and entrypoint/actions/decompose_work_items.py (AU-51b, agent-runtimes
commit 0fa8b760) reads CP_SERVICE_TOKEN_FILE directly, so no
transformation/staging step is required.
---
 .../spec-writing-sonnet-repo/v1/harness.yaml  |  3 +++
 .../contexts/cp-service-token/v1/harness.yaml | 23 +++++++++++++++++++
 2 files changed, 26 insertions(+)
 create mode 100644 harnesses/contexts/cp-service-token/v1/harness.yaml

diff --git a/harnesses/composites/spec-writing-sonnet-repo/v1/harness.yaml b/harnesses/composites/spec-writing-sonnet-repo/v1/harness.yaml
index a3eae18..e1cdd7b 100644
--- a/harnesses/composites/spec-writing-sonnet-repo/v1/harness.yaml
+++ b/harnesses/composites/spec-writing-sonnet-repo/v1/harness.yaml
@@ -8,3 +8,6 @@ layers:
   - context: anthropic-cloud-paul-oauth/v1
   - context: gitea-ssh/v1
   - context: agent-repo/v1
+  # AU-51/AU-51b: this composite backs scope-decompose-sonnet@1, which
+  # calls back POST /v1/work-items/{id}/decompose — needs a credential.
+  - context: cp-service-token/v1
diff --git a/harnesses/contexts/cp-service-token/v1/harness.yaml b/harnesses/contexts/cp-service-token/v1/harness.yaml
new file mode 100644
index 0000000..4dfc374
--- /dev/null
+++ b/harnesses/contexts/cp-service-token/v1/harness.yaml
@@ -0,0 +1,23 @@
+kind: context
+name: cp-service-token
+version: 1
+description: "CP-internal service bearer token — authenticates agent-container write calls back to the control plane (AU-51/AU-51b, bug b3a96acc)"
+requires: []
+provides: []
+
+# AU-51b: static env pointing at the ESO-mounted secret file. No init.sh
+# needed — the mount path is fixed at harness-authoring time (unlike
+# anthropic-cloud-paul-oauth/v1, which transforms its secret into a
+# different file format and therefore needs a staging script), and
+# decompose_work_items_action reads CP_SERVICE_TOKEN_FILE directly.
+# The value at this path MUST match the CP's CP_INTERNAL_BEARER_TOKEN
+# (same account: cp-decompose-service-token, account_id
+# 1d963673-6ac9-4f85-875a-2ce5323e76ad, owner (cp, cp)).
+env:
+  CP_SERVICE_TOKEN_FILE: /run/agent/secrets/cp-service-token/value
+
+secrets_required:
+  - name: cp-service-token
+    account_ref: "1d963673-6ac9-4f85-875a-2ce5323e76ad"
+    mount_path: /run/agent/secrets/cp-service-token
+    mode: "0400"